The Address
Stays Hot

The uncomfortable insight in this case is not that criminals use leaked data. It is that the leaked data has a shelf life measured in years, and that its unit of targeting is the address. Researchers tracking these attacks describe a shift toward data-driven targeting, in which crews merge tax leaks, breach dumps, exchange records, and residential data into standing files of households believed to hold crypto. Once an address enters such a file, nothing removes it. Sales, moves, and changed circumstances are invisible to the marketplace where the file trades. Whoever occupies the flagged address inherits the exposure.

The numbers around this case say it is not isolated. French authorities counted 77 crypto-related physical incidents in the first half of 2026, up from 45 in the same period a year earlier. Verified home invasions in the global dataset rose from a single case to twenty year over year. The address layer is doing real work in that growth.

Three groups carry exposure they did not create. Buyers of properties previously owned by visible or leaked crypto holders, who inherit a hot address with the deed. Sellers who move but whose old address still anchors their leaked identity, and whose new address can be joined to it through routine records. And families or staff who live at a flagged address without any connection to the assets at all. None of these groups shows up in a conventional threat model built around the principal's current holdings. All of them show up in the criminal file.

It is worth being precise about the one protective fact in this case. The first two attacks succeeded in reaching the residents. The third failed, because after the second attack the couple installed an alarm, and the response it triggered led to arrests and sentences. A single detection layer, added late, changed the outcome and imposed real cost on the attackers. That is the general lesson ERS draws across the residential caseload: detection and response layers do not need to be elaborate to be decisive, they need to exist before the attempt rather than after it.

Four disciplines follow. First, treat address history as live exposure. A residential risk assessment should cover not just the current property but what leaked and public data says about every address tied to the family. Second, when buying or selling a notable property, include data exposure in diligence, the same way title and survey are included. Third, layer detection at the residence and connect it to a response you have actually rehearsed. Fourth, maintain a household protocol that everyone at the address knows, including people with no connection to the assets, because the file does not distinguish and neither will the crew.

This briefing draws on August 2026 reporting from The Block, IBTimes UK, Crowdfund Insider, and French court coverage, alongside H1 2026 incident data from blockchain security researchers and French authorities. We do not identify the family, describe entry methods, or detail the property's security arrangements. The pattern is the point, and the pattern is what protects the next address on the list.